Source-linked AI summary
Towards Robustness Against Natural Language Word Substitutions
Xinshuai Dong, Anh Tuan Luu, Rongrong Ji, Hong Liu
TL;DR
Word-substitution defenses need perturbation sets that represent semantically similar alternatives without being too narrow or unnecessarily large. The paper introduces ASCC, which models substitutions with a regularized convex hull, and uses it for adversarial training. ASCC-defense reports better robustness across sentiment analysis and natural language inference, and its robustly trained word vectors can also be plugged into normally trained models.
Problem
Previous vector-space defenses model word substitutions with l2-balls or hyper-rectangles, producing sets that may be insufficiently inclusive or unnecessarily large for mimicking worst cases.
Source: §1 · p. 2Method
ASCC models the substitution space as a convex hull and regularizes perturbations toward actual substitutions; ASCC-defense uses ASCC-generated adversaries in adversarial training.
Source: §1 · p. 2, §3.3 · p. 5Results
Takeaways & Limitations
Robustly trained word vectors can be plugged into standard NLP models to improve robustness without applying another defense technique.
Source: §1 · p. 2, §6 · p. 9The work uses an existing substitution set and leaves construction of substitution sets for future exploration.
Source: §4.1 · p. 7
Abstract
from arXiv · showhide
Robustness against word substitutions has a well-defined and widely acceptable form, i.e., using semantically similar words as substitutions, and thus it is considered as a fundamental stepping-stone towards broader robustness in natural language processing. Previous defense methods capture word substitutions in vector space by using either $l_2$-ball or hyper-rectangle, which results in perturbation sets that are not inclusive enough or unnecessarily large, and thus impedes mimicry of worst cases for robust training. In this paper, we introduce a novel \textit{Adversarial Sparse Convex Combination} (ASCC) method. We model the word substitution attack space as a convex hull and leverages a regularization term to enforce perturbation towards an actual substitution, thus aligning our modeling better with the discrete textual space. Based on the ASCC method, we further propose ASCC-defense, which leverages ASCC to generate worst-case perturbations and incorporates adversarial training towards robustness. Experiments show that ASCC-defense outperforms the current state-of-the-arts in terms of robustness on two prevailing NLP tasks, \emph{i.e.}, sentiment analysis and natural language inference, concerning several attacks across multiple model architectures. Besides, we also envision a new class of defense towards robustness in NLP, where our robustly trained word vectors can be plugged into a normally trained model and enforce its robustness without applying any other defense techniques.
1 INTRODUCTION
Semantically similar word substitutions preserve much of an input’s syntax and meaning, making them difficult to detect and an important robustness target. The paper models substitutions with a convex hull and regularization, then uses ASCC-generated adversaries for training; experiments report stronger robustness across two tasks, multiple architectures, and attacks.
1 INTRODUCTION
- Semantically similar word substitutions preserve syntax and meaning to a substantial extent, making them difficult to detect and a fundamental robustness target.The paper distinguishes them from character edits and word deletions, additions, or swaps, which often damage grammaticality and naturality.Source: §1 · p. 1
- Prior l2-ball and hyper-rectangle models produce perturbation sets that can be too narrow or unnecessarily large, hindering precise mimicry of worst cases for robust training.Word-substitution attacks are combinatorial optimization problems whose discrete search space grows exponentially with input length.Source: §1 · p. 2
- ASCC models the substitution space as a convex hull and regularizes perturbations toward actual substitutions; ASCC-defense uses these adversaries in adversarial training.The convex hull is described as inclusive of allowed substitutions while excluding unnecessary cases.Source: §1 · p. 2
- ASCC-defense consistently outperforms state-of-the-art methods across sentiment analysis and natural language inference, including 79.0% accuracy versus 75.0% under Genetic attacks on IMDB.The evaluation covers four model architectures and two common attack methods.Source: §1 · p. 2
2 PRELIMINARIES
The paper frames robustness as finding worst-case substitutions from predefined alternatives for words in a text-classification input. It reviews vector-space perturbation models that enable gradient-based methods, while noting limitations of l2-balls, hyper-rectangles, and local directional approximations.
2.1 NOTATIONS AND PROBLEM SETTING
- The setup focuses on text classification, where words may be replaced by alternatives in a predefined set that typically contains semantically similar words, such as synonyms.The substitution set includes the original word; the described attacks seek worst-case inputs while defenses seek robustness to those substitutions.Source: §2.1 · pp. 2–3
2.2 PERTURBATION SET AT VECTOR LEVEL
- Vector-space perturbations permit gradient use despite the discrete, nonconvex textual input space; prior l2-ball methods can still miss substitution geometry.The review notes l2-ball adversarial training and extensions that consider directions toward substitutions.Source: §2.2 · p. 3
- Axis-aligned hyper-rectangles contain possible substitutions but may include unnecessary volume that grows with model depth and exponentially with embedding dimension.The passage notes that this approach can suit shallow architectures but often fails to use neural-network capacity fully.Source: §2.2 · p. 3
- Directional-gradient methods bridge continuous embeddings and discrete text through local approximation, but can miss global worst cases for robust training.Source: §2.2 · p. 3
3 METHODOLOGY
The methodology models allowed word substitutions with a convex hull, then uses ASCC-generated adversaries in adversarial training. A sparsity regularizer encourages perturbations closer to discrete substitutions.
3.1 OPTIMALITY OF USING CONVEX HULL
- The convex hull is continuous, contains all allowed substitution vectors, and is the smallest convex set that does so, supporting inclusiveness, compactness, and gradient-based optimization.The paper presents it as satisfying all three design criteria for the attack space.Source: §3.1 · p. 3
3.2 ADVERSARIAL SPARSE CONVEX COMBINATION
- Rather than recomputing convex-hull vertices for projections, the method relaxes combination coefficients and optimizes over them to generate convex-hull adversaries with gradients.Recomputing vertices is costly because word embeddings change during training; the relaxed formulation is projection-free.Source: §3.2 · p. 4
- Because combinations of multiple substitutions may not correspond to real words, ASCC uses entropy regularization to encourage sparse combination weights.The regularization weight α controls the regularization term.Source: §3.2 · pp. 4–5
3.3 ASCC-DEFENSE TOWARDS ROBUSTNESS
- ASCC-defense replaces the l2-ball perturbation with convex-hull adversaries and trains using KL divergence between clean and perturbed predictions, alongside coefficient sparsity.The entropy term affects inner-max adversary generation, not the model parameters directly.Source: §3.3 · pp. 5–6
- ASCC-defense updates word vectors using gradients involving all potential substitutions, which the authors propose yields more robust word vectors.The training process first generates ASCC adversaries with regularization, then uses them as inputs for adversarial training.Source: Figure 2 · p. 4, §3.3 · p. 6
- Adam solves both the inner maximization and outer minimization problems during training.The figure depicts adversary generation followed by adversarial training.Source: Figure 2 · p. 4, §3.3 · p. 6
4 EXPERIMENTS
Experiments evaluate ASCC-defense on IMDB sentiment analysis and SNLI natural language inference across four architectures and two attacks. They report stronger robustness than prior methods, test sparsity and alternative defenses, and examine robust word-vector transfer.
4.1 EXPERIMENTAL SETTING
- Evaluation covers IMDB sentiment analysis and SNLI natural language inference, four architectures, and Genetic and PWWS attacks.Robustness is measured on 1,000 randomly selected IMDB test examples and all 9,824 SNLI test examples.Source: §4.1 · pp. 6–7, §4.2 · p. 7
4.2 MAIN RESULT
- 6.5% under Genetic and 10.4% under PWWS: on IMDB, ASCC-defense exceeds the LSTM-based runner-up; its accuracy is also 79.0% under Genetic and 77.1% under PWWS.The reported leading robustness spans all architectures and both datasets.Source: §4.2 · pp. 7–8
4.3 ON THE REGULARIZATION AND OTHER DISCUSSIONS
- With α = 10, ASCC performs best; increasing α too far overemphasizes sparsity and weakens perturbations for robust training.Figure 4 illustrates sparsity, and Table 2 reports the regularization ablation.Source: Figure 4 · p. 7, Table 2 · p. 7, §4.3 · p. 8
- Enumeration is impractical at 6,108 average combinations per IMDB input, while random augmentation misses hard cases in the large attack space.Grouping substitutions sacrifices discriminative power: on IMDB it yields 71.3% robust and vanilla accuracy, versus ASCC-defense’s 79.0% robust and 82.5% vanilla accuracy.Source: §4.3 · p. 8
4.4 ROBUST WORD VECTORS
- Frozen ASCC-defense word vectors initialize normally trained models that remain robust without another defense; an LSTM reaches 73.4% under Genetic, versus 7.9% with GloVe.The comparison uses pre-trained vectors frozen during normal training.Source: §4.4 · p. 8, Table 3 · p. 8
5 RELATED WORK
Related work spans adversarial attacks and defenses in computer vision and several forms of NLP attacks. For word-substitution defense, ASCC differs from prior continuous-space models by enforcing sparsity throughout adversary generation.
5 RELATED WORK
- Computer-vision attacks include Lp-bounded, universal, and Wasserstein-based methods, while defenses include adversarial training, preprocessing, and generative classifiers.The passage cites Goodfellow et al. (2015), Madry et al. (2018), and others for these approaches.Source: §5 · p. 9
- NLP attacks include character manipulation, word deletion, insertion, or swapping, and semantically informed substitutions searched in text or generated using vector-space gradients.The cited examples include Alzantot et al. (2018), Ren et al. (2019), and Gong et al. (2018).Source: §5 · p. 9
- Prior defenses use first-order approximation, l2-balls, axis-aligned bounds, or Dirichlet-initialized convex combinations; ASCC enforces entropy-based sparsity throughout generation.The passage contrasts ASCC with Zhou et al. (2020), whose sparsity might be lost during adversary generation.Source: §5 · p. 9
6 CONCLUSION
The conclusion presents ASCC as a convex-hull method for adversarial word substitutions and reports consistent gains over state-of-the-art models. It also highlights robust word vectors that can support robustness without additional defense techniques.
6 CONCLUSION
- The proposed method uses a convex hull to capture and defend against adversarial word substitutions.This is the conclusion’s central methodological claim.Source: §6 · p. 9
- Across datasets and architectures, the method consistently surpasses state-of-the-art models.The conclusion does not specify numerical margins here.Source: §6 · p. 9
- The experiments indicate that word vectors themselves can be vulnerable and that robust vectors can enforce robustness without another defense technique.The conclusion frames this as a possible stepping stone toward broader NLP robustness.Source: §6 · p. 9
A.1 IMPLEMENTATION DETAILS
Implementation details specify text preprocessing, optimization settings, and architecture-specific configurations for the experiments.
A.1 IMPLEMENTATION DETAILS
- The preprocessing uses the NLTK tokenizer, ignores all punctuation marks, limits input length to 300 tokens for IMDB and 80 for SNLI, and assigns unknown words the NULL token.Source: §A.1 · p. 12
- Training uses α = 10 and β = 4; adversary generation runs Adam for 10 iterations with weight decay 0.00002.The passage also states that optimizer parameters for updating φ and θ vary by architecture.Source: §A.1 · p. 12
- Architecture settings include a size-3 CNN kernel for IMDB, bidirectional LSTM for IMDB, and three-layer MLP for summed-vector BOW on SNLI.The passage also describes a context-aware DECOMPATTN model for SNLI.Source: §A.1 · p. 12
A.2 RUNTIME ANALYSIS
Training times are reported for four model and task combinations. The supplied table caption identifies vanilla-accuracy comparisons across defense methods on IMDB and SNLI.
A.2 RUNTIME ANALYSIS
- 1.5 GPU hours for CNN and 2 GPU hours for LSTM are reported for IMDB training.Both times use a GeForce GTX1080 GPU.Source: §A.2 · p. 12
- 12 GPU hours for BOW and 15 GPU hours for DECOMPATTN are reported for SNLI training.Both times use a GeForce GTX1080 GPU.Source: §A.2 · p. 12
- Table 4 covers vanilla accuracy for defense methods on IMDB and SNLI.Source: Table 4 · p. 13
B ADDITIONAL EXPERIMENTAL RESULT
Additional results report ASCC-defense under Genetic attacks without a language-model constraint. The main-result setting retains that constraint for fair comparison with Jia et al.
B.1 VANILLA ACCURACY AND ROBUST ACCURACY UNDER GENETIC ATTACKS WITHOUT CONSTRAINT
- Tab.4 adds vanilla-accuracy results, with compared-method parameters selected for best robust accuracy rather than best vanilla accuracy.Source: §B.1 · p. 13
- 76.7% robust accuracy on IMDB and 72.8% on SNLI are reported for unconstrained Genetic attacks.The results use LSTM on IMDB and BOW on SNLI.Source: §B.1 · p. 13
B.2 PERFORMANCE ON BERT
The additional experiments report improved BERT robustness with ASCC-defense and a smaller convex-hull perturbation region than either comparison region.
B.2 PERFORMANCE ON BERT
- 70.2% robust accuracy under Genetic attacks on IMDB is reported for ASCC-defense BERT, versus 16.4% for standard fine-tuning.Source: §B.2 · p. 13
B.3 REDUCED PERTURBATION REGION
- The convex-hull area averages 29.2% of the hyper-rectangle area and 8.4% of the l2-ball area.The comparison uses smallest regions containing substitutions, with word vectors projected to 2D by SVD.Source: §B.3 · p. 14
B.4 CROSS-ARCHITECTURES PERFORMANCE OF ROBUST WORD VECTORS
Robust word vectors trained with ASCC-defense transfer across architectures, improving the robustness of normally trained models.
B.4 CROSS-ARCHITECTURES PERFORMANCE OF ROBUST WORD VECTORS
- 71.9% robust accuracy under Genetic attacks is reported for a CNN initialized with LSTM-trained robust word vectors, versus 8.6% with GloVe initialization.The CNN is normally trained after the robust word vectors are used for initialization.Source: §B.4 · p. 14